Traces show the path and timing of a request. Logs provide detailed records from the participating services. Correlate them with a trace identifier when applications include trace context in log records; otherwise use the service, operation, resource, and timestamp as supporting evidence.

Before you begin

  • Confirm that you can view both traces and logs for the client.
  • Use a narrow time range that includes the request.
  • Prefer structured log fields for trace_id and span_id. Field names can vary with the logging library and application configuration.

Investigate from a trace

  1. Open the trace and note its trace ID, start time, duration, services, and failed or slow spans.
  2. Select the service and time interval that most closely surround the span of interest.
  3. Open Logs and filter by the trace ID when that field is present.
  4. If the trace ID is unavailable, filter by service and resource attributes, then inspect records near the span timestamp.
  5. Compare log severity and event order with span status, events, and parent-child timing.

Interpret missing results

Trace-log correlation depends on the application propagating context and writing it into logs. Trace sampling, log filtering, different retention periods, missing resource attributes, or clock differences can prevent an exact match. Expand the time range gradually and validate the service identity before removing filters.


Do not treat a matching timestamp alone as proof that a log belongs to a trace. Use a trace ID or multiple shared attributes whenever possible.